SANS Cyber Threat Intelligence Summit & Training 2026

Mon, Jan 26 - Mon, Feb 2, 2026
12 Courses
English

Hilton Arlington Rosslyn The Key & Virtual (ET)

1900 Fort Myer Drive, Arlington, VA 22209

Cyber Threat Intelligence Summit & Training

Jump to:

Event Highlights
Courses
Speakers
Schedule
Location

Thank You To Our Sponsors

Summit: January 26-27 | Training: January 28 – February 2

If You Work in Cyber Threat Intelligence, This is The Must-Attend Event of the Year

Slide 1 of 2
Slide 2 of 2

Join us for our 14th Annual SANS Cyber Threat Intelligence Summit—an event devoted solely to the tradecraft of cyber threat analysis and intelligence.

Gain fresh perspectives and insights from leading practitioners who will share the latest real-world case studies, innovative techniques, and practical solutions designed to challenge CTI assumptions and deepen your understanding.

A key highlight of the Summit is the curated networking, offering CTI professionals opportunities to connect, share ideas, and build lasting relationships. Don't just take our word for it—see what past attendees say about the CTI Summit below.

This summit is critical for anyone in CTI regardless of experience level. The various elements required to be successful are presented and thoroughly discussed. - Robert Morgan, LANL

What Attendees Say

Slide 1 of 4
SANS consistently delivers the most exclusive, up-to-date content in the industry and the SANS CTI Summit 2025 is no exception.
Philip-Andrei G.
Slide 2 of 4
I left the Summit with an entire list of important action items. Incredible content overall!
Ken Hensley
Slide 3 of 4
The knowledge and insights I gained from this summit were outstanding. This is such a valuable event!
Hiren Parekh
Slide 4 of 4
The quality of the presentations at the SANS CTI Summit continues to be of the highest caliber each year, providing fresh, relevant, and valuable insights. Furthermore, the passion and commitment of the Summit Chairs, Board, and Selection Committee is evident, making the Summit the top convention and at the greatest value of the entire year for CTI Professionals.
Alex A.

Summit Highlights

Highly Technical Talks, Sessions, & Workshops

The industry's top practitioners will share their latest cyber threat intelligence research, solutions, tools, and case studies.

Cyber Threat Intelligence: Summit Speaker

One-Of-A-Kind Networking with The Top Minds In CTI

You’ll have the chance to engage with Summit Chairs, speakers, and your peers in the community for deep-dive discussions, and casual chats over breaks, meals, and evening receptions.

Summit Night Out

The days will be filled with the latest in CTI, but the fun goes up a notch at night for those joining us in Arlington.

Solutions Expo Hall

Explore the latest tools and solutions in cyber threat intelligence, and incident response.

World-Class SANS Courses

Enhance your knowledge base and add to your toolkit by bundling your Summit experience with a hands-on, immersive course taught by top SANS instructors and course authors.

Early Bird Offer

Save $500 USD using the code "EarlyBirdNA" and pay for any 4-6 day course (excluding Beta Courses and 300 Level Courses) by December 11, 2025.

Register

Summit and Course Registration

from $8,260 USD

In personIncludes

Course: Live Instructor Training with Hands-on Exercises
Course: DFIR NetWars Tournament with purchase of a course
Summit: Talks, Presentations and Workshops
Summit: Unmatched Networking
Summit: Evening Receptions
Summit: Access to Summit Exhibit Hall
Summit: Light Breakfast, Lunch, and Breaks with Snacks and Beverages

Select course to Enroll

Live onlineIncludes

Course: Virtual Live Instructor Training with Hands-On Exercises
Summit: Access to Select Talks
Summit: Interactive Chat on Slack
First Access to Approved Recordings and Decks

Select course to Enroll

Summit Registration Only

from Free

$625 USD*Prices exclude applicable local taxes

In personIncludes

Talks, Presentations and Workshops
Unmatched Networking
Evening Receptions
Access to Summit Exhibit Hall
Light Breakfast, Lunch, and Breaks with Snacks and Beverages
First Access to Approved Recordings and Decks

Attend In PersonLogin to register

Free

Live onlineIncludes

Access to Select Talks
Interactive Chat on Slack
First Access to Approved Recordings and Decks

Important Dates

Refund Deadline:: January 9, 2026
Hotel Group Discount Deadline:: January 3, 2026

Courses

Looking for Group Purchasing? Contact Us

Showing 10 of 12

Filter by:

SEC401: Security Essentials - Network, Endpoint, and Cloud

SEC401Cyber Defense

GIAC Security Essentials
6 Days
46 CPEs
Ross Bergman

Starts 28 Jan 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC504: Hacker Tools, Techniques, and Incident Handling

SEC504Offensive Operations

GIAC Certified Incident Handler
6 Days
38 CPEs
Joshua Wright

Starts 28 Jan 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics

FOR508Digital Forensics and Incident Response

GIAC Certified Forensic Analyst
6 Days
36 CPEs
Mike Pilkington

Starts 28 Jan 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR500: Windows Forensic Analysis

FOR500Digital Forensics and Incident Response

GIAC Certified Forensic Examiner
6 Days
36 CPEs
Heather Barnhart

Starts 28 Jan 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

FOR572Digital Forensics and Incident Response

GIAC Network Forensic Analyst
6 Days
36 CPEs
Philip Hagen

Starts 28 Jan 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR578: Cyber Threat Intelligence

FOR578Digital Forensics and Incident Response

GIAC Cyber Threat Intelligence
6 Days
36 CPEs
Peter Szczepankiewicz

Starts 28 Jan 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR498: Digital Acquisition and Rapid Triage

FOR498Digital Forensics and Incident Response

GIAC Battlefield Forensics and Acquisition
6 Days
36 CPEs
Eric Zimmerman

Starts 28 Jan 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC541: Cloud Security Threat Detection

SEC541Cloud Security

GIAC Cloud Threat Detection
5 Days
30 CPEs
Ryan Thompson

Starts 28 Jan 2026 at 8:30 AM ET
$8,260 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

FOR608: Enterprise-Class Incident Response & Threat Hunting

FOR608Digital Forensics and Incident Response

GIAC Enterprise Incident Responder
6 Days
36 CPEs
Marcus Guevara

Starts 28 Jan 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

SEC565: Red Team Operations and Adversary Emulation

SEC565Offensive Operations

GIAC Red Team Professional
6 Days
36 CPEs
David Mayer

Starts 28 Jan 2026 at 8:30 AM ET
$8,780 USD (Course)
$999 USD (Certification)
*Prices exclude applicable local taxes

View course details

Advisory Board

Rebekah Brown

Senior Researcher

Rebekah Brown has been instrumental in advancing cyber threat intelligence, serving as a network warfare analyst at the NSA, Operations Chief of a U.S. Marine Corps cyber unit, and training lead at U.S. Cyber Command.

Learn more

Rick Holland

VP, CISO, Office of the CISO

Rick is a seasoned cybersecurity leader with a unique background as a practitioner, vendor executive, and Forrester Research industry analyst. Rick supports ReliaQuest's Office of the CISO and manages the global team responsible for ReliaQuest's threat intelligence and research efforts.

Learn more

Katie Nickels

Director of Intelligence

Katie is the Director of Intelligence at Red Canary. She has worked on cyber threat intelligence, network defense, and incident response for nearly a decade for the U.S. Department of Defense, MITRE, Raytheon, and ManTech.

Learn more

Scott J. Roberts

Head of Threat Research

Scott is a security leader, analyst, software developer, and author. He is Head of Threat Research for Interpres Security and has led security teams and project in the defense industrial base, GitHub, Apple, Splunk, and most recently Argo AI.

Learn more

Andreas Sfakianakis

Cyber Threat Intelligence Expert

Andreas is a seasoned cyber threat intelligence professional with over 15 years in cybersecurity. He specializes in cyber threat analysis and building threat management programs.

Learn more

Gert-Jan Bruggink

Founder and CEO

Gert-Jan Bruggink specializes in helping leaders use proven systems to make informed decisions about digital risk.

Learn more

Schedule

Summit Dates

Monday 26th January & Tuesday 27th January

Training Dates

Wednesday 28th January - Wednesday 4th February

Showing 18 of 34

Filter by:

Select day:

Opening Remarks

09:00AM - 09:15AM EST

Presented by

Rebekah Brown

Certified Instructor Candidate

Rick Holland

VP, CISO, Office of the CISO

Katie Nickels

Certified Instructor

In-Person & Virtual

Keynote: To Be Announced

09:15AM - 10:00AM EST

In-Person & Virtual

Operation Trashpanda: Disrupting RaccoonO365’s Phishing Empire

In this session, Microsoft's Digital Crimes Unit (DCU) will dive into the recent disruption of RaccoonO365, the fastest-growing phishing-as-a-service (PhaaS) platform that sold phishing kits targeting Microsoft Office 365 users that empowered cybercriminals across 94 countries to steal thousands of Microsoft 365 credentials.

10:15AM - 10:50AM EST

Presented by

Maurice Mason

Principal Cybercrime Investigator

Nick Monaco

Principal Cybercrime Investigator

In-Person

NEW2CTI | Bling-up Your Intelligence Requirements: Enhancing Your CTI Requirements With the Diamond Model Of Intrusion Framework

Developing intelligence requirements is a recurring challenge often highlighted by the CTI community. Despite numerous great write-ups, discussions, and presentations on extracting and converting stakeholder needs into intelligence requirements, there is still plenty of room to explore practical ways of using requirements to evaluate and improve CTI lifecycles continuously.

10:15AM - 10:50AM EST

Presented by

Sherman Chu

Cyber Threat Intelligence Lead

In-Person & Virtual

The C2 You Didn’t See Coming: APT C2 Techniques That Redefine Stealth

Just when we thought we had seen every possible command and control technique, sophisticated adversaries continue to develop new methods to remain stealthy in compromised environments. These evolving techniques are actively reshaping the threat landscape.

10:50AM - 11:25AM EST

Presented by

Lior Rochberger

Principal Threat Researcher

Tom Fakterman

Senior Threat Researcher

In-Person

NEW2CTI | Operationalizing CTI: From PIRs to Priority TTPs

The value of Priority Intelligence Requirements (PIRs) is well-known in CTI, yet many teams, including ours, struggle to translate these high-level concepts into tangible, day-to-day actions of Security Operations, and Cyber Defense activities.

10:50AM - 11:25AM EST

Presented by

Ondra Rojcik

CTI Analyst

Keith Swagler

CTI Analyst

In-Person & Virtual

Hunting North Korea’s State-Sponsored “Contagious Interview” Operation: Attacks on Developers via the Software Supply Chain

North Korean state-sponsored threat actors behind the “Contagious Interview” operation blend social engineering with malicious open source packages to compromise developers and tech job seekers. Throughout 2025, we identified and analyzed hundreds of malicious npm packages (thousands of downloads) delivering stealthy, multi-stage loaders and infostealers that fetch the BeaverTail malware and the InvisibleFerret backdoor.

11:25AM - 12:00PM EST

Presented by

Kirill Boychenko

Senior Threat Intelligence Analyst

In-Person

NEW2CTI | Names Are Nice - Outcomes Are Better: Treat Attribution Like A Tool, Not A Trophy

In a world where names make headlines, everyone wants to know “who did it?” But for most teams, perfect attribution is expensive, and practical attribution is actionable. We’ll break down attribution into three functional tiers from tactical to operational to strategic - and show how to align your effort to your program’s maturity, deadlines, and data quality.

11:25AM - 12:00PM EST

Presented by

Chandler McClellan

Senior Consultant

In-Person & Virtual

Lunch

12:00PM - 01:15PM EST

In-Person

Beyond Bullet Points: Visual Intelligence in the Age of AI

The way we consume and interact with information constantly evolves. For intelligence analysts, the challenge is not just collecting and analyzing data, it’s how we transform that complexity into clarity for ourselves, our teams, and our stakeholders.

01:15PM - 01:50PM EST

Presented by

Sierra (Stanczyk) Karcher

Intelligence Practices Lead

David Johnson

Threat Intelligence Advisor

In-Person

NEW2CTI | Beyond the Feed: Designing CTI Programs That Matter to the Business

Across organizations, intelligence teams grapple with the following challenges: aligning the threat intelligence program with organization's business priorities, and articulating its tangible business value. How does a threat intelligence program ensure that insights on the current and emerging threat landscape reach the right stakeholders and ultimately safeguard business continuity and resiliency.

01:15PM - 01:50PM EST

Presented by

Sydney Jones

Global Head of Cyber Threat Intelligence

Arun Warikoo

Head of Cyber Threat Intelligence, CIB Americas

In-Person & Virtual

Beyond the Perimeter: Building a Ransomware Response Program for Third-Party Risk

As ransomware campaigns increasingly target third- and fourth-party vendors, organizations must rethink their threat intelligence and response strategies beyond the traditional perimeter. In this talk, I’ll share how I identified a critical gap in ransomware preparedness while working in the financial sector and built a scalable response program to address third-party risk.

01:50PM - 02:25PM EST

Presented by

Zarin Hamid

Senior Cyber Threat Intelligence Analyst

In-Person

NEW2CTI | Whenever, Wherever… Blind Eagle Attacks: The Shadow Vector Case

In mid-2025, Colombian users became the target of a coordinated campaign known as Shadow Vector, which combined local social engineering with privilege escalation exploits and court-themed SVG lure documents. Multiple vendors reported on the operation, attributing it to activity consistent with the "Blind Eagle" (APT C 36) threat group. While technically straightforward, the campaign shows how regional actors can merge simple malware with culturally resonant lures and creative delivery methods to achieve their goals.

01:50PM - 02:25PM EST

Presented by

Santiago Pontiroli

Lead Security Researcher - Threat Research Unit (TRU)

In-Person & Virtual

Applied Forecasting: Part Deux

Presently, many decision-makers view cyber forecasting as little more than creative brainstorming. Useful for discussion, not for decisions. As a result, they rarely ask CTI teams for forecasts, and when they do, they often don’t rely on them.

02:25PM - 03:00PM EST

Presented by

Gert-Jan Bruggink

Founder and CEO

Lincoln Kaffenberger

Global Cyber Threat Intelligence Lead

In-Person

Break

03:00PM - 03:15PM EST

In-Person

Rhadamanthys and The Limits of Private Sector Offensive Operations

This talk will debrief on an operation against the Rhadamanthys infostealer in the months following its initial release. Though this operation, we were able to obtain a copies of data stolen by attackers across all publicly identifiable control servers, using a combination of broad Internet scanning and a previously unreleased exploit. While technically successful, Rhadamanthys continues to be used today and has become increasingly resilient to disruption.

03:15PM - 03:50PM EST

Presented by

Silas Cutler

Principal Security Researcher

In-Person

To Be Announced

03:50PM - 04:25PM EST

In-Person